CVE-2026-42699
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
Risk Assessment
Risk of session theft, account takeover, or spreading malware to visitors.
Recommendation
Update the FV Player 8 plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in FV Player 8
See all- CVE-2026-95807Medium
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'synopsis' Shortcode Attribute in all versions up to and including 8.1.7 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute when a user visits the injected page.
- CVE-2026-83526High
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 8.1.7. The check_mimetype function lacks proper file type validation, allowing authenticated attackers with subscriber-level access or above to upload files that may be executable, leading to remote code execution. This requires exploiting a race condition.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS